# ws is same as root, layer is an exception to workspace
*.*.r=READER
*.*.w=NO_ONE
# topp, locked down, READER cannot see it
topp.*.r=READER
# but states is an exception 
topp.states.r=MILITARY
